diff --git a/application/Espo/Core/Formula/Parser.php b/application/Espo/Core/Formula/Parser.php index 79aa542630..fc60dc663a 100644 --- a/application/Espo/Core/Formula/Parser.php +++ b/application/Espo/Core/Formula/Parser.php @@ -66,6 +66,8 @@ class Parser private $variableNameRegExp = "/^[a-zA-Z0-9_\$]+$/"; + private $functionNameRegExp = "/^[a-zA-Z0-9_\\\\]+$/"; + public function parse(string $expression): stdClass { return $this->split($expression); @@ -115,6 +117,10 @@ class Parser $functionName = $this->operatorMap[$operator]; + if ($functionName === '' || !preg_match($this->functionNameRegExp, $functionName)) { + throw new SyntaxError("Bad function name `{$functionName}`."); + } + return (object) [ 'type' => $functionName, 'value' => [ @@ -527,6 +533,10 @@ class Parser $argumentSplittedList[] = $this->split($argument); } + if ($functionName === '' || !preg_match($this->functionNameRegExp, $functionName)) { + throw new SyntaxError("Bad function name `{$functionName}`."); + } + return (object) [ 'type' => $functionName, 'value' => $argumentSplittedList, diff --git a/tests/unit/Espo/Core/Formula/EvaluatorTest.php b/tests/unit/Espo/Core/Formula/EvaluatorTest.php index fd870bc51e..774aac0afb 100644 --- a/tests/unit/Espo/Core/Formula/EvaluatorTest.php +++ b/tests/unit/Espo/Core/Formula/EvaluatorTest.php @@ -589,4 +589,13 @@ class EvaluatorTest extends \PHPUnit\Framework\TestCase $this->evaluator->process($expression, null); } + + public function testSyntaxError9(): void + { + $expression = "test.test('test')"; + + $this->expectException(SyntaxError::class); + + $this->evaluator->process($expression, null); + } }